Clickjacking

Clickjacking is an attack in which a malicious page loads a target site in a transparent or disguised frame and positions it over a decoy button. The user believes they are clicking something harmless, but the click lands on a control in the hidden page, such as "delete account" or "confirm payment".

Why it matters

The victim's own browser session, with its cookies, performs the action, so no password needs to be stolen. The defence is for sites to control who may frame their pages. Two mechanisms do this: the X-Frame-Options header and the frame-ancestors directive of a Content Security Policy.

Example

A site that should never appear inside another page sends these headers:

X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'

Browsers that honour them refuse to render the page inside an iframe on another origin, so the overlay trick fails.

Common mistakes

• Sending no framing policy on pages with sensitive actions.
• Using only the obsolete ALLOW-FROM value of X-Frame-Options, which modern browsers ignore.
• Allowing broad framing for convenience when only one partner needs it.
• Relying on JavaScript frame-busting code, which can be bypassed.

Related

• X-Frame-Options
• Content Security Policy
• iframe
• CSRF

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.